13 ms·

Obama administration moves forward with unique Internet ID for all Americans

239 points by Stevenup7002 16y ago

deleted 16y ago
[deleted]
flyt 16y ago
The silver lining is that by the time this project goes through study after study, development, testing, and finally deployment 5-10 years will have passed and the Internet will fundamentally change in ways that either makes this instantly irrelevant or impossible to enforce.
- Alex3917 16y ago
  We need a publicly-controlled identity infrastructure that's compatible with the Internet. The problem isn't that internet ID is somehow evil, but rather the government.
  - drats 16y ago
    Remind me again of why we "need" a solution such as this? All this screeching reminds me of the people wanting a centralized solution to spam in the 1990s via government control or micropayments. We don't hear from them anymore because of spam filters and increased storage and bandwidth. My google account has double authentication now, telephone as well as a second email address, and serves as a central repository for all my other accounts across the web if I happen to forget a password. I can change providers if I want as well. Further, my VISA card is tied to my identity for purchases and donations. But anything that doesn't involve that isn't tied to my identity. So please just go shove it with your "need". It just makes me furious that this is even being proposed, it's totally unnecessary meddling and we all KNOW it will be abused.
    - Alex3917 16y ago
      "Remind me again of why we 'need' a solution such as this?" There are lots of services that people want that are impossible to build without a way to prove that someone is who they say they are. E.g. better reputation systems. "we all KNOW it will be abused." Obviously. That doesn't mean there isn't a need though.
      - malandrew 16y ago
        The private sector is already doing a much better job of building reputation systems. It's now a full-fledged area of computing work. There's even a sizable O'Reilly book on the topic.
      - drats 16y ago
        Last I checked there is an identity management authentication system you can use, for example Twitter has verified accounts (I don't know how they do it, perhaps by mail) or Bluehost asks for people to fax them a copy of an ID/Passport to get shell access (stupid, considering they have your VISA). So what you are saying is you are prepared to take the potential abuses because you want it to be more "seamless" than a fax, postcard or a $1 VISA charge. And that further these abuses are better than having a market solution where a commercial ID provider or bank does it themselves? Sounds like f--- all gain for a lot of risk. And we all know that beyond the abuses the "voluntary" nature of this will swiftly decline after it's implemented, so don't try to argue in that direction either. Just a reminder: the US government is currently illegally sifting through people's email, has wars going which are not authorized by congress, still runs a number of secret prisons across the world in which torture is conducted, is seeking people's private twitter messages in addition to their email because they have contact with Wikileaks, is groping people's genitals with high-school drop-outs in airports as well as taking naked photographs of them and has a "Homeland" tsar who is going to appear on telescreens installed in Walmarts to tell people to be alarmed and suspicous. Further, opposition movements have heated up the rhetoric of your politics to the point where there are open calls for the assassination of Julian Assange (who, like or dislike, is doing journalism) and the domestic rhetoric has been such that mentally ill people are now gunning down politicians. And you think it's advisable we install an ID system on the Internet because, in some unspecified way, it would be easier than a $1 VISA charge or a fax.... You sir, are very shill-like.
    - j_baker 16y ago
      This could be useful for allowing various levels of government to provide more services online. For instance, I wouldn't have to provide my social security number to a third party if I wanted to pay my taxes online. Or better yet, maybe they could allow voting online like Estonia does. Imagine what that would do for voter turnout.
      - sidek 16y ago
        "CLICK HERE TO VOTE FOR CANDIDATE A AND GET A NEW TYPE OF FARMVILLE CROP"
        j_baker 16y ago
        Fine. But you're missing my point. My point is that this would be useful for providing government services online. If you feel that online voting is a bad example then so be it.
  - waterlesscloud 16y ago
    Why?
  - lwhi 16y ago
    The government isn't the problem; the concept of top down control is the problem. No one group of people should ever be allowed this much power.
  - brc 16y ago
    No we don't. Currently messy systems ensure that caveat emptor is alive and well. Buying, selling and all the other activities on the internet may be easier to implement from a computer point of view with a centralised ID, but it's a very good thing that people employ caution in online activities. You cannot eliminate fraud, deceit and risk. You cannot create a utopia. These things are impossible, and all the best intentions in the world usually have bad unforeseen outcomes. Natural growth of systems is the best way forwards. A company like PayPal tries verification by depositing small amounts, it works, the consumers don't mind, so it stays. Another company tries something else, consumers don't like it, it goes. At no point is a central committee involved. This is the way it should be.
StavrosK 16y ago
Is this done anywhere else in the world? It is the scariest of the scary Big Brother measures I've seen recently...
- tommi 16y ago
  The Estonian ID card is somewhat similar http://en.wikipedia.org/wiki/Estonian_ID_card http://en.wikipedia.org/wiki/Estonian_ID_card
  - j_baker 16y ago
    Estonia is notable because their government does practically everything online.
- tallanvor 16y ago
  Norway has a unified authentication scheme for government sites, but that's as far as it goes. --If the US wants to do that, fine, but if they think private sites are really going to go for it, they're dreaming. I wouldn't trust the government to handle identification across multiple sites any more than I trust Facebook or Google.
  - JanezStupar 16y ago
    The Facebook will lead the pack. It will also try to establish itself as central authentication authority.
    - jpravetz 16y ago
      Except that no financial institution will accept a Facebook identity.
      - epochwolf 16y ago
        They will if the government mandates it.
bigsassy 16y ago
This article is pretty light on details. Here's a quote from the White House Cybersecurity Coordinator Howard Schmidt: Schmidt stressed today that anonymity and pseudonymity will remain possible on the Internet. "I don't have to get a credential, if I don't want to," he said. There's no chance that "a centralized database will emerge," and "we need the private sector to lead the implementation of this," he said. Read more: http://news.cnet.com/8301-31921_3-20027800-281.html#ixzz1AZDYQ3Kk http://news.cnet.com/8301-31921_3-20027800-281.html#ixzz1AZD...
- sliverstorm 16y ago
  I don't have to get (one) Cool. They've got the OK from me. It could turn out to be neat, and so long as it's optional I'm not worried.
  - reader5000 16y ago
    It'll be optional in the way driver's licenses are. If you want access to any internet service with value (e.g. google, etc.) you will need one. I can see it going that way.
    - jschuur 16y ago
      And what do you base this claim on?
  - CWuestefeld 16y ago
    so long as it's optional I'm not worried. I've got a bridge to sell you, too. Social Security Numbers, we were promised, would not be used as personal identifiers. See, e.g., http://query.nytimes.com/gst/fullpage.html?res=9C02EFD71039F935A15754C0A96E958260 http://query.nytimes.com/gst/fullpage.html?res=9C02EFD71039F... FOR many years, Social Security cards carried an admonition that they were to be used "for Social Security and tax purposes -- not for identification." You've got my personal guarantee that if an optional Internet ID is created today, it will be required before long. This is how the system works. Witness the gradual ratcheting up of (ridiculous) security measures in airports if you're skeptical.
daveman692 16y ago
This headline is actually pretty misleading. From what I've seen of the project, it is not about the government issuing online identities. Rather they've realized that people already have identities from services like Facebook and Google as well as banks. This project is aimed at making it possible for people to interact with government agencies using identities they already have. Some interactions require very little security and knowledge of who a person is (leaving a comment here for example) while others (paying your taxes) require quite a bit.
- thwarted 16y ago
  Is it really in the best interest of collecting taxes to defer authentication (and even authorization) to a third party such as Google, or even banks?
  - daveman692 16y ago
    I interact with the IRS once a year having to remember a short PIN I created years ago and can't figure out how to change. My bank has a very strong knowledge of who I am partially via http://en.wikipedia.org/wiki/Know_your_customer http://en.wikipedia.org/wiki/Know_your_customer and because I login to it on a much more frequent basis. It isn't that my bank would change the role of the IRS, but I'd login to the IRS using a strong identity issued by my bank versus this silly PIN I use today.
    - chopsueyar 16y ago
      ...or you could use the mail.
davidcuddeback 16y ago
This sounds very Orwellian, but I doubt much will become of this. Based on the statement the article attributes to Locke, it sounds like they're selling it to us as a single sign-on provider. Somehow, I doubt this will become as popular as current single sign-on providers such as Facebook or Google without legislation.
- jacoblyles 16y ago
  Couldn't they bully the ISPs to force everybody to use it? Seems like we should worry when they set up the groundwork for something like that, and not after the fact.
  - davidcuddeback 16y ago
    I don't see how this would be implemented at the ISP level, but maybe that's a failure of my imagination. I'm imagining something similar to Open ID. With no details about the government's plan for an internet ID, we're left to our imaginations, which probably vary widely from person to person.
    - Evgeny 16y ago
      I don't see how this would be implemented at the ISP level Simple: all new contracts with any ISP will require the customer to provide the internet ID. All existing contracts have to be renewed no later than {date}, and if the customer fails to provide the internet ID by that date, he is forcefully disconnected.
trotsky 16y ago
Actual draft of the proposal from June 2010: http://www.dhs.gov/xlibrary/assets/ns_tic.pdf http://www.dhs.gov/xlibrary/assets/ns_tic.pdf Note that if [generic scary three letter agency] wants to spy on you it's already quite easy for them to do so (see FISA, CALEA, NSLs, Sugar Grove, etc).
- forensic 16y ago
  >Note that if [generic scary three letter agency] wants to spy on you it's already quite easy for them to do so (see FISA, CALEA, NSLs, Sugar Grove, etc). It's not really about spying. It's about a government bureaucracy having the power to control your identity. If Visa cancels my card I can get an AMEX. The CIA has limited reach here.. the alphabet soups can't easily freeze my bank account. But if the government controls my ID card, they can shut me down utterly and I have no recourse aside from the broken judicial system. The simple fact of the matter is that corporations such as Visa and HSBC and Equifax are more trustworthy than the government. Giving the government the ability to authenticate humans online is giving them WAY TOO MUCH UNCHECKED POWER.
  - trotsky 16y ago
    But if the government controls my ID card Check all that apply: [ ] State Picture ID [ ] Passport [ ] Social Security Card The simple fact of the matter is that corporations such as Visa and HSBC and Equifax are more trustworthy than the government. You should really read the proposal. It's a federation of privately run PKI authorities. Potentially people like Visa, HSBC and Equifax.
unoti 16y ago
How the hell am I supposed to keep working under the table and dodging the IRS, if they're able to track me down because I just posted to Hacker News from this IP address? God, it gives me a cold chill feeling just thinking about it.
citricsquid 16y ago
It seems everybody is opposed to this sort of thing, but I love the idea of having a single piece of ID that works universally. I guess there are issues with identity theft being made easier, but I think the benefits outweigh the "privacy" concerns.
Twisol 16y ago
Sounds like Jeff Atwood got his wish! http://www.codinghorror.com/blog/2010/11/your-internet-drivers-license.html http://www.codinghorror.com/blog/2010/11/your-internet-drive...
drawkbox 16y ago
This is a waste of time. Any good intelligence organization can already gain most or all or probably too much of the information they need from online actions, transactions, networks, posts/comments, protocol sniffing, ISP/ad network data, re-routing/copying traffic, social hacking, infected pcs, etc. And if you are encrypting, proxying, spoofing then you are Anonymous and already on the radar. This Internet ID would just be a show piece.
- forensic 16y ago
  It's not about access to information, it's about the control to issue/deny IDs.
bcheung 16y ago
You can already sign up for a bank account online and prove you are who you say you are by inputting enough personal information so they can verify you. Sure there is potential for identity theft but much less so than with what they are proposing now. As far as single logins, there is already a well established solution with OpenID, OAuth, and the Log in with Facebook / Twitter style logins.
w1ntermute 16y ago
Is there anything in the legislation forcing businesses & their customers to use this ID for all transactions?
rman666 16y ago
Mark of the Beast! Mark of the Beast!
knowledgesale 16y ago
There are so many incentives for legislators to restrict the internet as we know it today and effectively no lobby to protect it. I am wondering if 10 years from now we are going to have much more "regulation and security" for the networks than now. Not only in the US, on the global scale. Who knows, it might be that the 90s-00s will be remembered as the only period in the human history when the truly free unregulated GLOBAL internet was possible. This view might look naive and hype-provoking and indeed the internet proved to be very robust on the big scale so far. However I have read recently about the very limited visa regulations for travelling around the most of the world in the 19th century. kind of puts things into perspective.
- cma 16y ago
  The great firewall existed in the 90's and the 2000's right?
binaryfinery 16y ago
You don't have to have ID either. But if you get into a bar, and the bar didn't card you, then the bar owner can go to jail. This is the law. 1. Create national ID: its optional. Yay freedom! 2. Pass law stating that if a national ID is not used as verification by a private entity, then said entity faces criminal charges, or its management is liable to its shareholders etc. Oh. Get a fucking clue. This is a national ID.
motters 16y ago
If it waddles like a national ID system and quacks like a national ID system, then it's probably a national ID system. Here in the UK we are fortunate to have recently dumped plans for a national ID system. Americans should do the same.
- j_baker 16y ago
  Just out of curiosity, if the national government in the UK doesn't issue IDs, who does? Counties? Cities?
  - motters 16y ago
    There are identifying documents, such as passports, drivers licenses and credit cards. These are sufficient for any situation where you might need to verify an identity.
  - adamt 16y ago
    Passports are issued by the UK Passport Office, and driving licenses by the DVLA (Driving & Vehicles Licensing Association). These are both effectively government agencies. However, as having a passport or a driving license is not compulsory, there were plans to have a national identity card, as is the case in many European countries that would be compulsory for all adults. This has fairly recently been scrapped before it was ever adopted. Partly because the cost ended up being estimated at £18B (US$30B). Quite how a database and some photo cards of 60M people(less if you only include adults) would cost that much is a mystery that only governments can solve!
    - nkassis 16y ago
      500$ a person is quite ridiculous for sure. I don't get either how this could happen.
    - Untitled 16y ago
      How do you identify yourself if there are no IDs? How do you identify illegal immigrants? I have a national identity document, and I fail to see the problem with it.
lwhi 16y ago
One more stake in the heart of liberty.
jrockway 16y ago
I'll be getting one of these when hell freezes over. If that means starting my own Internet, then that's exactly what I'll do.
- mark_l_watson 16y ago
  I would like to see more local (at the town level) shared networks. Something like cheap wi-fi base stations (really cheap!) that could link up a local area and have a good directory of what material people host to be shared, local bulletin boards, etc. I live in a rural area and several of my friends are going the self sufficient route and my wife and I are at least putting in enough solar panels to generate about 3/4 of the electricity that we currently use. The country I live in (USA) is in rapid decline and it would be naive to believe that all utilities and infrastructure will stay online 100% of the time. Having a useful local "localnet" would be a good idea, and could be fun also as a community activity. Perhaps libraires would be good hubs and meeting places to set this up. Even better to also get the local police, fire department and city government involved: something to bring the whole community together.
  - jrockway 16y ago
    The USA is in rapid decline? Let me guess, because teenagers use Facebook, spell "you" as "u" and house prices are not increasing as quickly as 5 years ago?
    - RickRoll 16y ago
      How about because ppl prefer religion over science. And security over freedom. Federal government getting more corrupt and more powerful with each year.
      - anamax 16y ago
        > How about because ppl prefer religion over science. And security over freedom. Federal government getting more corrupt and more powerful with each year. When do you think that each of those became true? Or is it that they've finally crossed a tipping point? I agree that they're all true, but they've been true since before 1776. And, as bad as the US is on an absolute scale, I'm having trouble finding some place better. Suggestions?
watmough 16y ago
And you can absolutely bet that this will be tied to a SSN and will be necessary in order to interact with the government. In some ways, this is reminiscent of Microsoft's attempt to 'reboot the internet' with their own security code. I believe it was called Hailstorm.
bretpiatt 16y ago
I shared my thoughts in detail about this more than a year ago, we should get out in front or as now coming true my prediction was, "As private industry and a world society I hope we can take care of this ourselves before it gets so out of control Congress tries to figure out how to do it and we end up with some horrible mess of a “National ID and Digital Identity Act” that looks at it only from the perspective of the USA and makes it very difficult for non-US citizens to do anything online (as most of the major Internet properties are US based) creating a whole new barrier for 3rd world citizens to overcome." http://www.bretpiatt.com/blog/2009/07/25/cloud-computing-makes-blacklists-obsolete-now-is-the-time-for-digital-identities/ http://www.bretpiatt.com/blog/2009/07/25/cloud-computing-mak...
- RickRoll 16y ago
  >>As private industry and a world society I hope we can take care of this ourselves before it gets so out of control Congress tries to figure out how to do it and we end up with some horrible mess of a “National ID and Digital Identity Act” that looks at it only from the perspective of the USA and makes it very difficult for non-US citizens to do anything online (as most of the major Internet properties are US based) creating a whole new barrier for 3rd world citizens to overcome. Major internet properties are international - Facebook, Paypal, Skype, Google, Microsoft's, Groupon, etc. Most countries have the technical talent to create clones of successful US startups. The problem is local governments will be able to control those local forums and social networks. So killing online freedom in US will kill it worldwide.
ulugbek 16y ago
I can sympathize with discontent about this, but almost nobody has brought up the positive uses of unique Internet ID. Suppose you want a system where you want to signal to all internet companies that you don't want your browsing data to be harbored without your consent. The ID system would allow the creation and enforcement of such system. The support for this comes in part because of pressure from the groups who are concerned about privacy and fretting over how their browsing data is used. While infringement of privacy hampers the growth of ecommerce, complete ban on harboring data hurts e-businesses (they won't be able to advertise efficiently). The solution to it is to create a free market: assign everyone a unique id, to which your preferences about harboring date will be assigned. Even better, data associated with that id can be considered proprietary, and users can license it to companies who are willing to pay for it and users can sue companies that infringe on this proprietary data bc courts will recognize it as solely yours. This is a good start if government wants to step in to protect your privacy from the "evil" corporations, while not hindering the growth of e-businesses. Ideally, you will be protected from corporations who are after your private data. Government, however, will surely continue using it the way you don't want.
- shotgun 16y ago
  The trouble is who has both ownership over and is able to exercise control over your identity data? I do like your idea of using licensing as a possible mechanism. It's one thing to say the government will host the ID data for free, for every American. (Or at least every American they deem worthy of a proof-of-online-identity certificate.) But possession is often viewed as 9/10ths of the law. Calling it "my" data is misleading if they really mean "data about me." Would I like to have a permanent, personal and authenticated key value store to in conjunction in some interpersonal or person-machine transactions? Absolutely. But I don't see how having a government issued identity solves the problem of how my browsing data might be misused elsewhere. It would seem that it only adds more personally-identifiable metadata that could be intercepted, tracked, or stolen along the way. How would such an ID system enable the creation and enforcement of a do-not-track list? That sounds appealing, but how does my identity being tracked stop me from being tracked?
younata 16y ago
IANAL, but this is technically legal, so long as it's used ONLY for commerce, by means of the Interstate Commerce Clause of the US Constitution. After that, it becomes unconstitutional, far as I know. So, in other words, it's unconstitutional, because it won't be used only for commerce.
- forensic 16y ago
  Constitution is meaningless these days. "Unconstitutional" is defined by the emotional whims and ideologies of judges.
  - prodigal_erik 16y ago
    The commerce clause in particular has been used to justify most anything, including laws around production of your own goods because that can function as an alternative to interstate commerce. But strict constructionism isn't an answer either. We shouldn't only have a right to bear 18th century arms, or let computer files be searched without a warrant merely because they aren't on paper. It's always going to be subjective, applying the law to questions that didn't even exist back when it was written. We have to do it, but we have to be more careful about it than we have.
    - forensic 16y ago
      That's why Jesus invented amendments to the constitution.
      - feawgo 16y ago
        thanks for the reminder that HN is now reddit.
  - jschuur 16y ago
    I thought 'unconstitutional' was defined by pundits, politicians and commenters who didn't like the latest policy du jour by Guy In Charge?
rlpb 16y ago
We are going to end up with something sooner or later. The fact is that we want (and can) enter into contracts on the Internet. In order to enforce contracts we must have identities. Since the Government (specifically the judiciary) enforces contracts, this means that we must be entering into these contracts under Government-managed identities. Currently we acquire and prove this Government-managed identity using an ad-hoc, decentralised, system with much duplication. I can use a passport or my driver's license or my birth certificate or perhaps some utility bills or some combination. This causes various problems, including fraud and waste. If two parties mutually choose to enter into a contract over the Internet, and this contract is to be enforced by the judiciary, then it would be ideal for them to be able to verify each others' legal entities and authorisation. I think that properly implemented this could eliminate a large amount of online fraud. Nothing about the principle of such a system inherently creates privacy problems, since when parties enter into a contract they already expect to reveal their identities to each other, and nothing would necessarily be forcing people to reveal their identities in any other situation, just the same as is the case at the moment.T here is a risk of a slippery slope of course; I can't deny that. There's no reason such a system has to be centralised, though. X.509 certificates would work fine, for example, issued at the same time as a birth certificate, with each local office as a CA. Unfortunately, the problem is with implementation. I don't think that any government is competent enough to put a system together that does meet privacy requirements, and there are too many self-interested parties who would influence and corrupt the design of such a system.
- dantheman 16y ago
  >>We are going to end up with something sooner or later. I think this type of attitude really hurts in a democracy. Every year people push bad ideas, and we must fight back against them.
  - rlpb 16y ago
    I'm saying that the principle is a good idea, makes sense and that's why it'll happen eventually. The problem is the implementation. I'm happy to fight bad ideas. Here in the UK we managed to fight off the first bad implementation they tried to push on us.
guynamedloren 16y ago
Great, another channel for identity theft.
- deleted 16y ago
  [deleted]
Groxx 16y ago
In a blue block on page 18 of http://www.dhs.gov/xlibrary/assets/ns_tic.pdf http://www.dhs.gov/xlibrary/assets/ns_tic.pdf : >Envision It! An individual learns of a new and more secure way to access online services using a strong credential provided by a trustworthy service provider. Running this past my parents was met with a blank stare, followed by "what?". And they're significantly better about their online habits than most people, especially the ones they're targeting with a system like this. Anyone interested in identity online already has several means of proving they are who they say they are, and can generate X.509 certificates to provide ridiculous-quality proof for individual transactions. While I fully expect something along these lines to exist eventually, I'm honestly scared by the sunshine-and-ponies descriptions in that document. They're also making enormous claims of universal interoperability that reek to me of XML/SOAP/etc evangelization - it never works that well. (Link thanks to trotsky: http://news.ycombinator.com/item?id=2086135 http://news.ycombinator.com/item?id=2086135 )
lionhearted 16y ago
Profile: Sebastian Marshall. Internet ID 353-808-A331. Known aliases: "lionhearted". Primary contact info: sebastian@sebastianmarshall.com Political positions: A believer in liberty, pro-international travel and open borders, tends towards mild hostility towards regulation. Generally law-abiding. Friendliness to American Interests Rating (FAIR): 72/100
- narrator 16y ago
  That 353-808-A331 is the lower 64 bits of your ipv6 address anytime you do anything online. You won't have to login anywhere! If you need to do something important you'll just sign with your private key and the gov will graciously provide the public key keyserver. I've been trying to tell that to everybody for years. Your Fair Score is actually your TerrorScore. Would you like to sort social media profiles by TerrorScore? They will undoubtedly use Google PageRank like Eigenvectors to calculate it based on who you're linked to and your ipv6 traffic profile. I hate to be an Ipv6 cynic but after all, Ipv4 NAT is the best thing that ever happened to online anonymity.
  - wmf 16y ago
    IPv4 NAT is the best thing that ever happened to online anonymity. There's exactly one person behind my NAT; how many are behind yours?
    - bad_user 16y ago
      Yes, but how many people know that?
    - pyre 16y ago
      There were several papers over the past few years about using traffic analysis to figure out what's going on behind a NAT. I'm sure that the US government could manage to do this with all of the ISP-level snooping gear.
  - drdaeman 16y ago
    NAT just adds a port number to your identity. And port number changes more frequently. Anyway, if you're talking about governments (so ISPs are required to cooperate, by law), 3-tuple (IP, port, timestamp) is enough to identify you. Even more traditional (IP, timestamp) pair is enough for low-to-medium-trafficked ISPs or sites.
ebaysucks 16y ago
In a few years time, the government will block your access to the internet for not doing as you're told. As all services become digital eventually, the guy controlling the central ID system will be able to literally let you starve to death. The fight for internet freedom is really the most important one in human history. If we don't win, we'll end up with a government that can actually enforce ALL its laws ALL the time.
shooll 16y ago
( http://www.findsoso.com http://www.findsoso.com / ) (( http://www.findsoso.com http://www.findsoso.com / ) We need your support and trust!!! Dear friends, please temporarily stop your footsteps To our website Walk around A look at Maybe you'll find happiness in your sight shopping heaven and earth You'll find our price is more suitable for you. Welcome to our website ( http://www.findsoso.com http://www.findsoso.com / ) Thanks to the support! ( http://www.findsoso.com http://www.findsoso.com / ) ( http://www.findsoso.com http://www.findsoso.com / ) ( http://www.findsoso.com http://www.findsoso.com /
nlavezzo 16y ago
To those who would say "it'll be optional - you won't need one to search Google, check you email, etc." I point out that there are already huge efforts to track people across domains and build profiles of them. Private companies are ALREADY slobbering over this, and paying good money for even anonymized datasets. If this system goes into practice, it will simply be good business for websites to require your ID as part of the signup process. Also, open networks (like attwifi, etc.) may begin to require these as well. They could build nice juicy datasets of the Starbucks laptop crowd, and believe me they'd be hot selling items. That's probably a best case scenario by the way. How long until it's mandated that your ISP has your internet ID, and public networks (attwifi, etc.) are required to get it to let you out into the internet?
gersh 16y ago
I think a government OAuth sounds like a good idea. Verifying your identity based on SSN is pretty insecure. If the commerce department can come up with a secure standard, it can seriously cut down on fraud. Internet anonymity is good for some things, but the government needs to stop people from borrowing in someone else's name. Security will probably be challenge. This needs to be done right, but it has great potential for cutting down on fraud. With real identity, scammers can blacklisted, and honest can people can transact business better. Despite the FUD, I think this is actually good government.
sp4rki 16y ago
Why is it that people insist on calling US citizens Americans? Canadians, Chileans, Brazilians, Panamanians, Colombians, etc are all Americans also, and this move does not apply to them at all. The American population is composed of everyone this side of the pond and not of everyone to the north only. Journalists should make a distinction.
- JoeAltmaier 16y ago
  Perhaps because we're the only ones to actually put the work "America" in our country's name.
- JoeAltmaier 16y ago
  Perhaps because we're the only ones to actually put the work "America" in our country's name.
contextfree 16y ago
So far as I can tell what is actually being discussed is an official certification scheme for third-party identity providers. This would make it more feasible for third-party IDs to be accepted in contexts where they're currently not. I don't see how that can be reasonably characterized as a "unique Internet ID for all Americans", but whatevs.
korch 16y ago
No matter what they build, ultimately it's based on public key crypto methods. So this is all a moot point after mathematicians make a break through and smash public key encryption methods. Sure, that might not happen for a decade, who knows really. But I still wouldn't want to place my trust in a vast gov't controlled multibillion dollar single point of failure that controls all authentication in society. But good luck with your totalitarian schemes Big Brother guys, the more you try, the more the free society grows and strengthens like kudzu.
dennisgorelik 16y ago
Government tends to be inefficient in Internet business. The Government would screw things up in multiple ways: too slow, too expensive, too much corruption, not flexible etc.
ck2 16y ago
Even if it is optional to start with, it's like every other government "security theater" nonsense and there will be mission-creep to make it mandatory sooner or later. Absolutely no way this should be allowed to be enacted, in any form. Government should simply enforce the existing spammer laws and ensure net neutrality.
dkokelley 16y ago
This was a minor plot device in the book Ender's Game, where two super-intelligent children needed to borrow their father's network citizen access to post on the forums about their ideas. Obviously this isn't what the administration is suggesting, but it seems like a dangerous first step. I don't like it. I'm happy with an optional OpenID-like system for stronger authentication and convenient access to account logins, but the system should be 100% optional. There's no way I'm going to trust anyone with the ability to masquerade as me through a closed system. Imagine using Facebook Connect or Google to log in to your bank. Facebook has no business involving me and my bank. It is between me and my bank only. And there is no reason for me to risk my full, unlimited online identity to a single provider like Facebook or Google. The government also has no business knowing who my bank or email provider of choice are.
yters 16y ago
How long until a national ID turns into an international ID to combat terrorism?
plan9 16y ago
Don't worry. This is just the lube.
eurohacker 16y ago
Gongradulations fello americans, your illuminati oligarchs have promoted you, to become ID numbers with unique identity http://www.youtube.com/watch?v=Ct9xzXUQLuY http://www.youtube.com/watch?v=Ct9xzXUQLuY

239 points by Stevenup7002 16y ago

deleted 16y ago

[deleted]

flyt 16y ago

The silver lining is that by the time this project goes through study after study, development, testing, and finally deployment 5-10 years will have passed and the Internet will fundamentally change in ways that either makes this instantly irrelevant or impossible to enforce.

Alex3917 16y ago
We need a publicly-controlled identity infrastructure that's compatible with the Internet. The problem isn't that internet ID is somehow evil, but rather the government.
- drats 16y ago
  Remind me again of why we "need" a solution such as this? All this screeching reminds me of the people wanting a centralized solution to spam in the 1990s via government control or micropayments. We don't hear from them anymore because of spam filters and increased storage and bandwidth. My google account has double authentication now, telephone as well as a second email address, and serves as a central repository for all my other accounts across the web if I happen to forget a password. I can change providers if I want as well. Further, my VISA card is tied to my identity for purchases and donations. But anything that doesn't involve that isn't tied to my identity. So please just go shove it with your "need". It just makes me furious that this is even being proposed, it's totally unnecessary meddling and we all KNOW it will be abused.
  - Alex3917 16y ago
    "Remind me again of why we 'need' a solution such as this?" There are lots of services that people want that are impossible to build without a way to prove that someone is who they say they are. E.g. better reputation systems. "we all KNOW it will be abused." Obviously. That doesn't mean there isn't a need though.
    - malandrew 16y ago
      The private sector is already doing a much better job of building reputation systems. It's now a full-fledged area of computing work. There's even a sizable O'Reilly book on the topic.
    - drats 16y ago
      Last I checked there is an identity management authentication system you can use, for example Twitter has verified accounts (I don't know how they do it, perhaps by mail) or Bluehost asks for people to fax them a copy of an ID/Passport to get shell access (stupid, considering they have your VISA). So what you are saying is you are prepared to take the potential abuses because you want it to be more "seamless" than a fax, postcard or a $1 VISA charge. And that further these abuses are better than having a market solution where a commercial ID provider or bank does it themselves? Sounds like f--- all gain for a lot of risk. And we all know that beyond the abuses the "voluntary" nature of this will swiftly decline after it's implemented, so don't try to argue in that direction either. Just a reminder: the US government is currently illegally sifting through people's email, has wars going which are not authorized by congress, still runs a number of secret prisons across the world in which torture is conducted, is seeking people's private twitter messages in addition to their email because they have contact with Wikileaks, is groping people's genitals with high-school drop-outs in airports as well as taking naked photographs of them and has a "Homeland" tsar who is going to appear on telescreens installed in Walmarts to tell people to be alarmed and suspicous. Further, opposition movements have heated up the rhetoric of your politics to the point where there are open calls for the assassination of Julian Assange (who, like or dislike, is doing journalism) and the domestic rhetoric has been such that mentally ill people are now gunning down politicians. And you think it's advisable we install an ID system on the Internet because, in some unspecified way, it would be easier than a $1 VISA charge or a fax.... You sir, are very shill-like.
  - j_baker 16y ago
    This could be useful for allowing various levels of government to provide more services online. For instance, I wouldn't have to provide my social security number to a third party if I wanted to pay my taxes online. Or better yet, maybe they could allow voting online like Estonia does. Imagine what that would do for voter turnout.
    - sidek 16y ago
      "CLICK HERE TO VOTE FOR CANDIDATE A AND GET A NEW TYPE OF FARMVILLE CROP"
      - j_baker 16y ago
        Fine. But you're missing my point. My point is that this would be useful for providing government services online. If you feel that online voting is a bad example then so be it.
- waterlesscloud 16y ago
  Why?
- lwhi 16y ago
  The government isn't the problem; the concept of top down control is the problem. No one group of people should ever be allowed this much power.
- brc 16y ago
  No we don't. Currently messy systems ensure that caveat emptor is alive and well. Buying, selling and all the other activities on the internet may be easier to implement from a computer point of view with a centralised ID, but it's a very good thing that people employ caution in online activities. You cannot eliminate fraud, deceit and risk. You cannot create a utopia. These things are impossible, and all the best intentions in the world usually have bad unforeseen outcomes. Natural growth of systems is the best way forwards. A company like PayPal tries verification by depositing small amounts, it works, the consumers don't mind, so it stays. Another company tries something else, consumers don't like it, it goes. At no point is a central committee involved. This is the way it should be.

StavrosK 16y ago

Is this done anywhere else in the world? It is the scariest of the scary Big Brother measures I've seen recently...

tommi 16y ago
The Estonian ID card is somewhat similar http://en.wikipedia.org/wiki/Estonian_ID_card http://en.wikipedia.org/wiki/Estonian_ID_card
- j_baker 16y ago
  Estonia is notable because their government does practically everything online.
tallanvor 16y ago
Norway has a unified authentication scheme for government sites, but that's as far as it goes. --If the US wants to do that, fine, but if they think private sites are really going to go for it, they're dreaming. I wouldn't trust the government to handle identification across multiple sites any more than I trust Facebook or Google.
- JanezStupar 16y ago
  The Facebook will lead the pack. It will also try to establish itself as central authentication authority.
  - jpravetz 16y ago
    Except that no financial institution will accept a Facebook identity.
    - epochwolf 16y ago
      They will if the government mandates it.

bigsassy 16y ago

This article is pretty light on details. Here's a quote from the White House Cybersecurity Coordinator Howard Schmidt: Schmidt stressed today that anonymity and pseudonymity will remain possible on the Internet. "I don't have to get a credential, if I don't want to," he said. There's no chance that "a centralized database will emerge," and "we need the private sector to lead the implementation of this," he said. Read more: http://news.cnet.com/8301-31921_3-20027800-281.html#ixzz1AZDYQ3Kk http://news.cnet.com/8301-31921_3-20027800-281.html#ixzz1AZD...

sliverstorm 16y ago
I don't have to get (one) Cool. They've got the OK from me. It could turn out to be neat, and so long as it's optional I'm not worried.
- reader5000 16y ago
  It'll be optional in the way driver's licenses are. If you want access to any internet service with value (e.g. google, etc.) you will need one. I can see it going that way.
  - jschuur 16y ago
    And what do you base this claim on?
- CWuestefeld 16y ago
  so long as it's optional I'm not worried. I've got a bridge to sell you, too. Social Security Numbers, we were promised, would not be used as personal identifiers. See, e.g., http://query.nytimes.com/gst/fullpage.html?res=9C02EFD71039F935A15754C0A96E958260 http://query.nytimes.com/gst/fullpage.html?res=9C02EFD71039F... FOR many years, Social Security cards carried an admonition that they were to be used "for Social Security and tax purposes -- not for identification." You've got my personal guarantee that if an optional Internet ID is created today, it will be required before long. This is how the system works. Witness the gradual ratcheting up of (ridiculous) security measures in airports if you're skeptical.

daveman692 16y ago

This headline is actually pretty misleading. From what I've seen of the project, it is not about the government issuing online identities. Rather they've realized that people already have identities from services like Facebook and Google as well as banks. This project is aimed at making it possible for people to interact with government agencies using identities they already have. Some interactions require very little security and knowledge of who a person is (leaving a comment here for example) while others (paying your taxes) require quite a bit.

thwarted 16y ago
Is it really in the best interest of collecting taxes to defer authentication (and even authorization) to a third party such as Google, or even banks?
- daveman692 16y ago
  I interact with the IRS once a year having to remember a short PIN I created years ago and can't figure out how to change. My bank has a very strong knowledge of who I am partially via http://en.wikipedia.org/wiki/Know_your_customer http://en.wikipedia.org/wiki/Know_your_customer and because I login to it on a much more frequent basis. It isn't that my bank would change the role of the IRS, but I'd login to the IRS using a strong identity issued by my bank versus this silly PIN I use today.
  - chopsueyar 16y ago
    ...or you could use the mail.

davidcuddeback 16y ago

This sounds very Orwellian, but I doubt much will become of this. Based on the statement the article attributes to Locke, it sounds like they're selling it to us as a single sign-on provider. Somehow, I doubt this will become as popular as current single sign-on providers such as Facebook or Google without legislation.

jacoblyles 16y ago
Couldn't they bully the ISPs to force everybody to use it? Seems like we should worry when they set up the groundwork for something like that, and not after the fact.
- davidcuddeback 16y ago
  I don't see how this would be implemented at the ISP level, but maybe that's a failure of my imagination. I'm imagining something similar to Open ID. With no details about the government's plan for an internet ID, we're left to our imaginations, which probably vary widely from person to person.
  - Evgeny 16y ago
    I don't see how this would be implemented at the ISP level Simple: all new contracts with any ISP will require the customer to provide the internet ID. All existing contracts have to be renewed no later than {date}, and if the customer fails to provide the internet ID by that date, he is forcefully disconnected.

trotsky 16y ago

Actual draft of the proposal from June 2010: http://www.dhs.gov/xlibrary/assets/ns_tic.pdf http://www.dhs.gov/xlibrary/assets/ns_tic.pdf Note that if [generic scary three letter agency] wants to spy on you it's already quite easy for them to do so (see FISA, CALEA, NSLs, Sugar Grove, etc).

forensic 16y ago
>Note that if [generic scary three letter agency] wants to spy on you it's already quite easy for them to do so (see FISA, CALEA, NSLs, Sugar Grove, etc). It's not really about spying. It's about a government bureaucracy having the power to control your identity. If Visa cancels my card I can get an AMEX. The CIA has limited reach here.. the alphabet soups can't easily freeze my bank account. But if the government controls my ID card, they can shut me down utterly and I have no recourse aside from the broken judicial system. The simple fact of the matter is that corporations such as Visa and HSBC and Equifax are more trustworthy than the government. Giving the government the ability to authenticate humans online is giving them WAY TOO MUCH UNCHECKED POWER.
- trotsky 16y ago
  But if the government controls my ID card Check all that apply: [ ] State Picture ID [ ] Passport [ ] Social Security Card The simple fact of the matter is that corporations such as Visa and HSBC and Equifax are more trustworthy than the government. You should really read the proposal. It's a federation of privately run PKI authorities. Potentially people like Visa, HSBC and Equifax.

unoti 16y ago

How the hell am I supposed to keep working under the table and dodging the IRS, if they're able to track me down because I just posted to Hacker News from this IP address? God, it gives me a cold chill feeling just thinking about it.

citricsquid 16y ago

It seems everybody is opposed to this sort of thing, but I love the idea of having a single piece of ID that works universally. I guess there are issues with identity theft being made easier, but I think the benefits outweigh the "privacy" concerns.

Twisol 16y ago

Sounds like Jeff Atwood got his wish! http://www.codinghorror.com/blog/2010/11/your-internet-drivers-license.html http://www.codinghorror.com/blog/2010/11/your-internet-drive...

drawkbox 16y ago

This is a waste of time. Any good intelligence organization can already gain most or all or probably too much of the information they need from online actions, transactions, networks, posts/comments, protocol sniffing, ISP/ad network data, re-routing/copying traffic, social hacking, infected pcs, etc. And if you are encrypting, proxying, spoofing then you are Anonymous and already on the radar. This Internet ID would just be a show piece.

forensic 16y ago
It's not about access to information, it's about the control to issue/deny IDs.

bcheung 16y ago

You can already sign up for a bank account online and prove you are who you say you are by inputting enough personal information so they can verify you. Sure there is potential for identity theft but much less so than with what they are proposing now. As far as single logins, there is already a well established solution with OpenID, OAuth, and the Log in with Facebook / Twitter style logins.

w1ntermute 16y ago

Is there anything in the legislation forcing businesses & their customers to use this ID for all transactions?

rman666 16y ago

Mark of the Beast! Mark of the Beast!

knowledgesale 16y ago

There are so many incentives for legislators to restrict the internet as we know it today and effectively no lobby to protect it. I am wondering if 10 years from now we are going to have much more "regulation and security" for the networks than now. Not only in the US, on the global scale. Who knows, it might be that the 90s-00s will be remembered as the only period in the human history when the truly free unregulated GLOBAL internet was possible. This view might look naive and hype-provoking and indeed the internet proved to be very robust on the big scale so far. However I have read recently about the very limited visa regulations for travelling around the most of the world in the 19th century. kind of puts things into perspective.

cma 16y ago
The great firewall existed in the 90's and the 2000's right?

binaryfinery 16y ago

You don't have to have ID either. But if you get into a bar, and the bar didn't card you, then the bar owner can go to jail. This is the law. 1. Create national ID: its optional. Yay freedom! 2. Pass law stating that if a national ID is not used as verification by a private entity, then said entity faces criminal charges, or its management is liable to its shareholders etc. Oh. Get a fucking clue. This is a national ID.

motters 16y ago

If it waddles like a national ID system and quacks like a national ID system, then it's probably a national ID system. Here in the UK we are fortunate to have recently dumped plans for a national ID system. Americans should do the same.

j_baker 16y ago
Just out of curiosity, if the national government in the UK doesn't issue IDs, who does? Counties? Cities?
- motters 16y ago
  There are identifying documents, such as passports, drivers licenses and credit cards. These are sufficient for any situation where you might need to verify an identity.
- adamt 16y ago
  Passports are issued by the UK Passport Office, and driving licenses by the DVLA (Driving & Vehicles Licensing Association). These are both effectively government agencies. However, as having a passport or a driving license is not compulsory, there were plans to have a national identity card, as is the case in many European countries that would be compulsory for all adults. This has fairly recently been scrapped before it was ever adopted. Partly because the cost ended up being estimated at £18B (US$30B). Quite how a database and some photo cards of 60M people(less if you only include adults) would cost that much is a mystery that only governments can solve!
  - nkassis 16y ago
    500$ a person is quite ridiculous for sure. I don't get either how this could happen.
  - Untitled 16y ago
    How do you identify yourself if there are no IDs? How do you identify illegal immigrants? I have a national identity document, and I fail to see the problem with it.

lwhi 16y ago

One more stake in the heart of liberty.

jrockway 16y ago

I'll be getting one of these when hell freezes over. If that means starting my own Internet, then that's exactly what I'll do.

mark_l_watson 16y ago
I would like to see more local (at the town level) shared networks. Something like cheap wi-fi base stations (really cheap!) that could link up a local area and have a good directory of what material people host to be shared, local bulletin boards, etc. I live in a rural area and several of my friends are going the self sufficient route and my wife and I are at least putting in enough solar panels to generate about 3/4 of the electricity that we currently use. The country I live in (USA) is in rapid decline and it would be naive to believe that all utilities and infrastructure will stay online 100% of the time. Having a useful local "localnet" would be a good idea, and could be fun also as a community activity. Perhaps libraires would be good hubs and meeting places to set this up. Even better to also get the local police, fire department and city government involved: something to bring the whole community together.
- jrockway 16y ago
  The USA is in rapid decline? Let me guess, because teenagers use Facebook, spell "you" as "u" and house prices are not increasing as quickly as 5 years ago?
  - RickRoll 16y ago
    How about because ppl prefer religion over science. And security over freedom. Federal government getting more corrupt and more powerful with each year.
    - anamax 16y ago
      > How about because ppl prefer religion over science. And security over freedom. Federal government getting more corrupt and more powerful with each year. When do you think that each of those became true? Or is it that they've finally crossed a tipping point? I agree that they're all true, but they've been true since before 1776. And, as bad as the US is on an absolute scale, I'm having trouble finding some place better. Suggestions?

watmough 16y ago

And you can absolutely bet that this will be tied to a SSN and will be necessary in order to interact with the government. In some ways, this is reminiscent of Microsoft's attempt to 'reboot the internet' with their own security code. I believe it was called Hailstorm.

bretpiatt 16y ago

I shared my thoughts in detail about this more than a year ago, we should get out in front or as now coming true my prediction was, "As private industry and a world society I hope we can take care of this ourselves before it gets so out of control Congress tries to figure out how to do it and we end up with some horrible mess of a “National ID and Digital Identity Act” that looks at it only from the perspective of the USA and makes it very difficult for non-US citizens to do anything online (as most of the major Internet properties are US based) creating a whole new barrier for 3rd world citizens to overcome." http://www.bretpiatt.com/blog/2009/07/25/cloud-computing-makes-blacklists-obsolete-now-is-the-time-for-digital-identities/ http://www.bretpiatt.com/blog/2009/07/25/cloud-computing-mak...

RickRoll 16y ago
>>As private industry and a world society I hope we can take care of this ourselves before it gets so out of control Congress tries to figure out how to do it and we end up with some horrible mess of a “National ID and Digital Identity Act” that looks at it only from the perspective of the USA and makes it very difficult for non-US citizens to do anything online (as most of the major Internet properties are US based) creating a whole new barrier for 3rd world citizens to overcome. Major internet properties are international - Facebook, Paypal, Skype, Google, Microsoft's, Groupon, etc. Most countries have the technical talent to create clones of successful US startups. The problem is local governments will be able to control those local forums and social networks. So killing online freedom in US will kill it worldwide.

ulugbek 16y ago

I can sympathize with discontent about this, but almost nobody has brought up the positive uses of unique Internet ID. Suppose you want a system where you want to signal to all internet companies that you don't want your browsing data to be harbored without your consent. The ID system would allow the creation and enforcement of such system. The support for this comes in part because of pressure from the groups who are concerned about privacy and fretting over how their browsing data is used. While infringement of privacy hampers the growth of ecommerce, complete ban on harboring data hurts e-businesses (they won't be able to advertise efficiently). The solution to it is to create a free market: assign everyone a unique id, to which your preferences about harboring date will be assigned. Even better, data associated with that id can be considered proprietary, and users can license it to companies who are willing to pay for it and users can sue companies that infringe on this proprietary data bc courts will recognize it as solely yours. This is a good start if government wants to step in to protect your privacy from the "evil" corporations, while not hindering the growth of e-businesses. Ideally, you will be protected from corporations who are after your private data. Government, however, will surely continue using it the way you don't want.

shotgun 16y ago
The trouble is who has both ownership over and is able to exercise control over your identity data? I do like your idea of using licensing as a possible mechanism. It's one thing to say the government will host the ID data for free, for every American. (Or at least every American they deem worthy of a proof-of-online-identity certificate.) But possession is often viewed as 9/10ths of the law. Calling it "my" data is misleading if they really mean "data about me." Would I like to have a permanent, personal and authenticated key value store to in conjunction in some interpersonal or person-machine transactions? Absolutely. But I don't see how having a government issued identity solves the problem of how my browsing data might be misused elsewhere. It would seem that it only adds more personally-identifiable metadata that could be intercepted, tracked, or stolen along the way. How would such an ID system enable the creation and enforcement of a do-not-track list? That sounds appealing, but how does my identity being tracked stop me from being tracked?

younata 16y ago

IANAL, but this is technically legal, so long as it's used ONLY for commerce, by means of the Interstate Commerce Clause of the US Constitution. After that, it becomes unconstitutional, far as I know. So, in other words, it's unconstitutional, because it won't be used only for commerce.

forensic 16y ago
Constitution is meaningless these days. "Unconstitutional" is defined by the emotional whims and ideologies of judges.
- prodigal_erik 16y ago
  The commerce clause in particular has been used to justify most anything, including laws around production of your own goods because that can function as an alternative to interstate commerce. But strict constructionism isn't an answer either. We shouldn't only have a right to bear 18th century arms, or let computer files be searched without a warrant merely because they aren't on paper. It's always going to be subjective, applying the law to questions that didn't even exist back when it was written. We have to do it, but we have to be more careful about it than we have.
  - forensic 16y ago
    That's why Jesus invented amendments to the constitution.
    - feawgo 16y ago
      thanks for the reminder that HN is now reddit.
- jschuur 16y ago
  I thought 'unconstitutional' was defined by pundits, politicians and commenters who didn't like the latest policy du jour by Guy In Charge?

rlpb 16y ago

We are going to end up with something sooner or later. The fact is that we want (and can) enter into contracts on the Internet. In order to enforce contracts we must have identities. Since the Government (specifically the judiciary) enforces contracts, this means that we must be entering into these contracts under Government-managed identities. Currently we acquire and prove this Government-managed identity using an ad-hoc, decentralised, system with much duplication. I can use a passport or my driver's license or my birth certificate or perhaps some utility bills or some combination. This causes various problems, including fraud and waste. If two parties mutually choose to enter into a contract over the Internet, and this contract is to be enforced by the judiciary, then it would be ideal for them to be able to verify each others' legal entities and authorisation. I think that properly implemented this could eliminate a large amount of online fraud. Nothing about the principle of such a system inherently creates privacy problems, since when parties enter into a contract they already expect to reveal their identities to each other, and nothing would necessarily be forcing people to reveal their identities in any other situation, just the same as is the case at the moment.T here is a risk of a slippery slope of course; I can't deny that. There's no reason such a system has to be centralised, though. X.509 certificates would work fine, for example, issued at the same time as a birth certificate, with each local office as a CA. Unfortunately, the problem is with implementation. I don't think that any government is competent enough to put a system together that does meet privacy requirements, and there are too many self-interested parties who would influence and corrupt the design of such a system.

dantheman 16y ago
>>We are going to end up with something sooner or later. I think this type of attitude really hurts in a democracy. Every year people push bad ideas, and we must fight back against them.
- rlpb 16y ago
  I'm saying that the principle is a good idea, makes sense and that's why it'll happen eventually. The problem is the implementation. I'm happy to fight bad ideas. Here in the UK we managed to fight off the first bad implementation they tried to push on us.

guynamedloren 16y ago

Great, another channel for identity theft.

deleted 16y ago
[deleted]

Groxx 16y ago

In a blue block on page 18 of http://www.dhs.gov/xlibrary/assets/ns_tic.pdf http://www.dhs.gov/xlibrary/assets/ns_tic.pdf : >Envision It! An individual learns of a new and more secure way to access online services using a strong credential provided by a trustworthy service provider. Running this past my parents was met with a blank stare, followed by "what?". And they're significantly better about their online habits than most people, especially the ones they're targeting with a system like this. Anyone interested in identity online already has several means of proving they are who they say they are, and can generate X.509 certificates to provide ridiculous-quality proof for individual transactions. While I fully expect something along these lines to exist eventually, I'm honestly scared by the sunshine-and-ponies descriptions in that document. They're also making enormous claims of universal interoperability that reek to me of XML/SOAP/etc evangelization - it never works that well. (Link thanks to trotsky: http://news.ycombinator.com/item?id=2086135 http://news.ycombinator.com/item?id=2086135 )

lionhearted 16y ago

Profile: Sebastian Marshall. Internet ID 353-808-A331. Known aliases: "lionhearted". Primary contact info: sebastian@sebastianmarshall.com Political positions: A believer in liberty, pro-international travel and open borders, tends towards mild hostility towards regulation. Generally law-abiding. Friendliness to American Interests Rating (FAIR): 72/100

narrator 16y ago
That 353-808-A331 is the lower 64 bits of your ipv6 address anytime you do anything online. You won't have to login anywhere! If you need to do something important you'll just sign with your private key and the gov will graciously provide the public key keyserver. I've been trying to tell that to everybody for years. Your Fair Score is actually your TerrorScore. Would you like to sort social media profiles by TerrorScore? They will undoubtedly use Google PageRank like Eigenvectors to calculate it based on who you're linked to and your ipv6 traffic profile. I hate to be an Ipv6 cynic but after all, Ipv4 NAT is the best thing that ever happened to online anonymity.
- wmf 16y ago
  IPv4 NAT is the best thing that ever happened to online anonymity. There's exactly one person behind my NAT; how many are behind yours?
  - bad_user 16y ago
    Yes, but how many people know that?
  - pyre 16y ago
    There were several papers over the past few years about using traffic analysis to figure out what's going on behind a NAT. I'm sure that the US government could manage to do this with all of the ISP-level snooping gear.
- drdaeman 16y ago
  NAT just adds a port number to your identity. And port number changes more frequently. Anyway, if you're talking about governments (so ISPs are required to cooperate, by law), 3-tuple (IP, port, timestamp) is enough to identify you. Even more traditional (IP, timestamp) pair is enough for low-to-medium-trafficked ISPs or sites.

ebaysucks 16y ago

In a few years time, the government will block your access to the internet for not doing as you're told. As all services become digital eventually, the guy controlling the central ID system will be able to literally let you starve to death. The fight for internet freedom is really the most important one in human history. If we don't win, we'll end up with a government that can actually enforce ALL its laws ALL the time.

shooll 16y ago

( http://www.findsoso.com http://www.findsoso.com / ) (( http://www.findsoso.com http://www.findsoso.com / ) We need your support and trust!!! Dear friends, please temporarily stop your footsteps To our website Walk around A look at Maybe you'll find happiness in your sight shopping heaven and earth You'll find our price is more suitable for you. Welcome to our website ( http://www.findsoso.com http://www.findsoso.com / ) Thanks to the support! ( http://www.findsoso.com http://www.findsoso.com / ) ( http://www.findsoso.com http://www.findsoso.com / ) ( http://www.findsoso.com http://www.findsoso.com /

nlavezzo 16y ago

To those who would say "it'll be optional - you won't need one to search Google, check you email, etc." I point out that there are already huge efforts to track people across domains and build profiles of them. Private companies are ALREADY slobbering over this, and paying good money for even anonymized datasets. If this system goes into practice, it will simply be good business for websites to require your ID as part of the signup process. Also, open networks (like attwifi, etc.) may begin to require these as well. They could build nice juicy datasets of the Starbucks laptop crowd, and believe me they'd be hot selling items. That's probably a best case scenario by the way. How long until it's mandated that your ISP has your internet ID, and public networks (attwifi, etc.) are required to get it to let you out into the internet?

gersh 16y ago

I think a government OAuth sounds like a good idea. Verifying your identity based on SSN is pretty insecure. If the commerce department can come up with a secure standard, it can seriously cut down on fraud. Internet anonymity is good for some things, but the government needs to stop people from borrowing in someone else's name. Security will probably be challenge. This needs to be done right, but it has great potential for cutting down on fraud. With real identity, scammers can blacklisted, and honest can people can transact business better. Despite the FUD, I think this is actually good government.

sp4rki 16y ago

Why is it that people insist on calling US citizens Americans? Canadians, Chileans, Brazilians, Panamanians, Colombians, etc are all Americans also, and this move does not apply to them at all. The American population is composed of everyone this side of the pond and not of everyone to the north only. Journalists should make a distinction.

JoeAltmaier 16y ago
Perhaps because we're the only ones to actually put the work "America" in our country's name.
JoeAltmaier 16y ago
Perhaps because we're the only ones to actually put the work "America" in our country's name.

contextfree 16y ago

So far as I can tell what is actually being discussed is an official certification scheme for third-party identity providers. This would make it more feasible for third-party IDs to be accepted in contexts where they're currently not. I don't see how that can be reasonably characterized as a "unique Internet ID for all Americans", but whatevs.

korch 16y ago

No matter what they build, ultimately it's based on public key crypto methods. So this is all a moot point after mathematicians make a break through and smash public key encryption methods. Sure, that might not happen for a decade, who knows really. But I still wouldn't want to place my trust in a vast gov't controlled multibillion dollar single point of failure that controls all authentication in society. But good luck with your totalitarian schemes Big Brother guys, the more you try, the more the free society grows and strengthens like kudzu.

dennisgorelik 16y ago

Government tends to be inefficient in Internet business. The Government would screw things up in multiple ways: too slow, too expensive, too much corruption, not flexible etc.

ck2 16y ago

Even if it is optional to start with, it's like every other government "security theater" nonsense and there will be mission-creep to make it mandatory sooner or later. Absolutely no way this should be allowed to be enacted, in any form. Government should simply enforce the existing spammer laws and ensure net neutrality.

dkokelley 16y ago

This was a minor plot device in the book Ender's Game, where two super-intelligent children needed to borrow their father's network citizen access to post on the forums about their ideas. Obviously this isn't what the administration is suggesting, but it seems like a dangerous first step. I don't like it. I'm happy with an optional OpenID-like system for stronger authentication and convenient access to account logins, but the system should be 100% optional. There's no way I'm going to trust anyone with the ability to masquerade as me through a closed system. Imagine using Facebook Connect or Google to log in to your bank. Facebook has no business involving me and my bank. It is between me and my bank only. And there is no reason for me to risk my full, unlimited online identity to a single provider like Facebook or Google. The government also has no business knowing who my bank or email provider of choice are.

yters 16y ago

How long until a national ID turns into an international ID to combat terrorism?

plan9 16y ago

Don't worry. This is just the lube.

eurohacker 16y ago

Gongradulations fello americans, your illuminati oligarchs have promoted you, to become ID numbers with unique identity http://www.youtube.com/watch?v=Ct9xzXUQLuY http://www.youtube.com/watch?v=Ct9xzXUQLuY